Staging Environment: Content and features may be unstable or change without notice.
Advisory details: ubuntu_osv / UBUNTU-CVE-2014-9235
Advisory ID ubuntu_osv/UBUNTU-CVE-2014-9235
Aliases CVE-2014-9235
Summary Multiple SQL injection vulnerabilities in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) _action parameter to group.php or (2) user.php or the (3) location_id parameter to photos.php in php/.
Status Published
Exploitability 2.0
Weighted Severity 6.2
Risk 10.0
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
ubuntu-priority medium https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2014/UBUNTU-CVE-2014-9235.json
Reference id Reference type URL
http://seclists.org/fulldisclosure/2014/Nov/45
https://github.com/jeroenrnl/zoph/issues/59
https://ubuntu.com/security/CVE-2014-9235
https://www.cve.org/CVERecord?id=CVE-2014-9235
Data source Exploit-DB
Date added Nov. 17, 2014
Description Zoph 0.9.1 - Multiple Vulnerabilities
Ransomware campaign use Unknown
Source publication date Nov. 17, 2014
Exploit type webapps
Platform php
Source update date Nov. 17, 2014

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.